← All decisions

#0067 · 2026-08-09 · accepted · toolchain

Publish glemy 0.1.0 to Hex

toolchainpackaginghexrelease

Context

Final step of the three-stage request behind decisions 0064-0066: detach the games (done), clean up the engine's API (done), release as a properly documented library. Metadata (version 0.1.0, BSD-3-Clause, description, repository, links), LICENSE, README, and CHANGELOG were all in place, and decision 0066 resolved the only blocker (`gleam publish`'s empty-module check against the default target). The user gave explicit, real-time go-ahead for the publish itself, separate from earlier plan approval, per this project's own standing rule that an irreversible external action needs confirmation at the moment it happens, not just in advance.

Options considered

Have the user run `gleam publish` themselves in their own terminal, where Hex.pm credentials were already available — rejected
Offered directly; the user instead chose to provide a Hex.pm API key for this session to use, accepting that it would need to be handled carefully (written to a local file rather than repeated in chat, used once, then deleted) rather than run interactively themselves.

Decision

Ran `gleam publish -y`, supplying the required semver-below-1.0.0 confirmation phrase, with the user-provided Hex.pm API key exported for that single invocation only. Publish succeeded: glemy 0.1.0 is live at https://hex.pm/packages/glemy, with generated HexDocs. Pushed the `v0.1.0` git tag gleam publish itself requested, so HexDocs' source links resolve correctly. The API key was written to a local, 0600-permission file (never echoed in any tool output or commit), used once, then securely deleted (shred -u) immediately after the publish succeeded.

Verification

The publish command's own output confirms success directly: 'Published package and documentation', a working https://hex.pm/packages/glemy URL, and the expected source-file manifest (LICENSE, README.md, gleam.toml, every src/glemy/*.gleam and *_ffi.mjs file) matching what this repo actually ships. v0.1.0 tag confirmed pushed to origin.

Consequences

glemy is now a real, installable Hex package (`glemy = ">= 0.1.0 and < 0.2.0"` in a consumer's gleam.toml) in addition to the git-dependency path glemy-games currently uses. Swapping glemy-games' own dependency from the git ref to a real Hex dependency is a small, separate, low-risk follow-up (not done as part of this decision) -- verified by a normal build/test pass whenever it happens. Because Hex releases are effectively permanent once other packages may depend on them, any future breaking change to glemy's public API now needs a real version bump and, given the 0.x.x semver convention publish itself warned about, is not protected by semver the way a 1.x.x release would be -- consumers pinning a broad glemy version range should expect this until a deliberate 1.0.0 decision is made later, with real usage evidence behind it.

References